CVE-2022-21716

Twisted SSH version identifier DoS

• CVSS 7.5
• CWE-770
• Resource Management
• Remote

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

CVE

CVE-2022-21716

CWE

CWE-770

CVSS base score

7.5

Published

2022-03-03

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to Twisted version 22.2.0 or higher.

from twisted.conch.ssh import transport
from twisted.internet import reactor

class Transport(transport.SSHTransport):
    def connectionSecure(self):
        super().connectionSecure()

def create_server():
    from twisted.internet import protocol
    from twisted.conch.ssh import factory

    class SSHFactory(factory.SSHFactory):
        def buildProtocol(self, addr):
            return Transport()

    reactor.listenTCP(22, SSHFactory())
    reactor.run()

create_server()

from twisted.conch.ssh import transport
from twisted.internet import reactor

class Transport(transport.SSHTransport):
    MAX_VERSION_LENGTH = 255

    def connectionSecure(self):
        if len(self.peerVersion) > self.MAX_VERSION_LENGTH:
            raise ValueError("SSH version identifier too long")
        super().connectionSecure()

def create_server():
    from twisted.internet import protocol
    from twisted.conch.ssh import factory

    class SSHFactory(factory.SSHFactory):
        def buildProtocol(self, addr):
            return Transport()

    reactor.listenTCP(22, SSHFactory())
    reactor.run()

create_server()

@misc{vaitp:cve202221716,
  title        = {{Twisted SSH version identifier DoS}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-21716},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-21716/}}
}